fileks.go

package cncc

/**
 * @Author: WeiBingtao/13156050650@163.com
 * @Version: 1.0
 * @Description:
 * @Date: 2020/9/15 上午11:28
 */
import (
	"bytes"
	"encoding/hex"
	"errors"
	"fmt"
	"io/ioutil"
	"os"
	"path/filepath"
	"strings"
	"sync"
	
	"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp"
	"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/utils"
	"github.com/hyperledger/fabric-sdk-go/internal/github.com/tjfoc/gmsm/sm2"
	"github.com/hyperledger/fabric-sdk-go/internal/github.com/tjfoc/gmsm/sm4"
)

// NewFileBasedKeyStore instantiated a file-based key store at a given position.
// The key store can be encrypted if a non-empty password is specifiec.
// It can be also be set as read only. In this case, any store operation
// will be forbidden
func NewFileBasedKeyStore(pwd []byte, path string, readOnly bool) (bccsp.KeyStore, error) {
	ks := &fileBasedKeyStore{}
	return ks, ks.Init(pwd, path, readOnly)
}

// fileBasedKeyStore is a folder-based KeyStore.
// Each key is stored in a separated file whose name contains the key's SKI
// and flags to identity the key's type. All the keys are stored in
// a folder whose path is provided at initialization time.
// The KeyStore can be initialized with a password, this password
// is used to encrypt and decrypt the files storing the keys.
// A KeyStore can be read only to avoid the overwriting of keys.
type fileBasedKeyStore struct {
	path string
	
	readOnly bool
	isOpen   bool
	
	pwd []byte
	
	// Sync
	m sync.Mutex
}

// Init initializes this KeyStore with a password, a path to a folder
// where the keys are stored and a read only flag.
// Each key is stored in a separated file whose name contains the key's SKI
// and flags to identity the key's type.
// If the KeyStore is initialized with a password, this password
// is used to encrypt and decrypt the files storing the keys.
// The pwd can be nil for non-encrypted KeyStores. If an encrypted
// key-store is initialized without a password, then retrieving keys from the
// KeyStore will fail.
// A KeyStore can be read only to avoid the overwriting of keys.
func (ks *fileBasedKeyStore) Init(pwd []byte, path string, readOnly bool) error {
	// Validate inputs
	// pwd can be nil
	
	if len(path) == 0 {
		return errors.New("An invalid KeyStore path provided. Path cannot be an empty string.")
	}
	
	ks.m.Lock()
	defer ks.m.Unlock()
	
	if ks.isOpen {
		return errors.New("KeyStore already initilized.")
	}
	ks.path = path
	ks.pwd = utils.Clone(pwd)
	err := ks.createKeyStoreIfNotExists()
	if err != nil {
		return err
	}
	
	err = ks.openKeyStore()
	if err != nil {
		return err
	}
	
	ks.readOnly = readOnly
	
	return nil
}

// ReadOnly returns true if this KeyStore is read only, false otherwise.
// If ReadOnly is true then StoreKey will fail.
func (ks *fileBasedKeyStore) ReadOnly() bool {
	return ks.readOnly
}


// GetKey returns a key object whose SKI is the one passed.
func (ks *fileBasedKeyStore) GetKey(ski []byte) (k bccsp.Key, err error) {
	// Validate arguments
	//if len(ski) == 0 {
	//	return nil, errors.New("Invalid SKI. Cannot be of zero length.")
	//}
	//
	//suffix := ks.getSuffix(hex.EncodeToString(ski))
	//
	//switch suffix {
	//case "key":
	//	// Load the key
	//	key, err := ks.loadKey(hex.EncodeToString(ski))
	//	if err != nil {
	//		return nil, fmt.Errorf("Failed loading key [%x] [%s]", ski, err)
	//	}
	//
	//	return &gmsm4PrivateKey{key, false}, nil
	//case "sk":
	//	// Load the private key
	//	key, err := ks.loadPrivateKey(hex.EncodeToString(ski))
	//	if err != nil {
	//		return nil, fmt.Errorf("Failed loading secret key [%x] [%s]", ski, err)
	//	}
	//
	//	switch key.(type) {
	//	case *sm2.PrivateKey:
	//		return &gmsm2PrivateKey{key.(*sm2.PrivateKey)}, nil
	//	default:
	//		return nil, errors.New("Secret key type not recognized")
	//	}
	//case "pk":
	//	// Load the public key
	//	key, err := ks.loadPublicKey(hex.EncodeToString(ski))
	//	if err != nil {
	//		return nil, fmt.Errorf("Failed loading public key [%x] [%s]", ski, err)
	//	}
	//
	//	switch key.(type) {
	//	case *sm2.PublicKey:
	//		return &gmsm2PublicKey{key.(*sm2.PublicKey)}, nil
	//	default:
	//		return nil, errors.New("Public key type not recognized")
	//	}
	//default:
	//	return ks.searchKeystoreForSKI(ski)
	//}
	return nil, nil
}

// StoreKey stores the key k in this KeyStore.
// If this KeyStore is read only then the method will fail.
func (ks *fileBasedKeyStore) StoreKey(k bccsp.Key) (err error) {
	if ks.readOnly {
		return errors.New("Read only KeyStore")
	}
	
	if k == nil {
		return errors.New("Invalid key. It must be different from nil")
	}
	switch k.(type) {
	case *gmsm2PrivateKey:
		err = ks.storePrivateKey(hex.EncodeToString(k.SKI()), string(k.SKI()))
		if err != nil {
			return fmt.Errorf("Failed storing GMSM2 private key [%s]", err)
		}
	case *gmsm2PublicKey:
		kk := k.(*gmsm2PublicKey)
		err = ks.storePublicKey(hex.EncodeToString(k.SKI()), kk.pubKey)
		if err != nil {
			return fmt.Errorf("Failed storing GMSM2 public key [%s]", err)
		}
	case *gmsm4PrivateKey:
		kk := k.(*gmsm4PrivateKey)
		
		// keypath := ks.getPathForAlias(hex.EncodeToString(k.SKI()), "key")
		
		err = ks.storeKey(hex.EncodeToString(k.SKI()), kk.privKey)
		if err != nil {
			return fmt.Errorf("Failed storing GMSM4 key [%s]", err)
		}
	default:
		return fmt.Errorf("Key type not reconigned [%s]", k)
	}
	
	return
}

func (ks *fileBasedKeyStore) searchKeystoreForSKI(ski []byte) (k bccsp.Key, err error) {
	
	files, _ := ioutil.ReadDir(ks.path)
	for _, f := range files {
		if f.IsDir() {
			continue
		}
		raw, err := ioutil.ReadFile(filepath.Join(ks.path, f.Name()))
		if err != nil {
			continue
		}
		
		key, err := utils.PEMtoPrivateKey(raw, ks.pwd)
		if err != nil {
			continue
		}
		
		switch key.(type) {
		case *sm2.PrivateKey:
			k = &gmsm2PrivateKey{ski, gmsm2PublicKey{ski, &key.(*sm2.PrivateKey).PublicKey}}
		default:
			continue
		}
		
		if !bytes.Equal(k.SKI(), ski) {
			continue
		}
		
		return k, nil
	}
	return nil, errors.New("Key type not recognized")
}

func (ks *fileBasedKeyStore) getSuffix(alias string) string {
	files, _ := ioutil.ReadDir(ks.path)
	for _, f := range files {
		if strings.HasPrefix(f.Name(), alias) {
			if strings.HasSuffix(f.Name(), "sk") {
				return "sk"
			}
			if strings.HasSuffix(f.Name(), "pk") {
				return "pk"
			}
			if strings.HasSuffix(f.Name(), "key") {
				return "key"
			}
			break
		}
	}
	return ""
}

// 接口保存的是私钥的  ski
func (ks *fileBasedKeyStore) storePrivateKey(alias string, ski string) error {
	
	// 临时目录 只是为了测试用，生产的时候，keypath 不会为空
	if ks.path == "" {
		ks.path = filepath.Join(os.TempDir(), "keystore-test")
		os.MkdirAll(ks.path, 0755)
		logger.Warningf("keystore path [%s]", ks.path)
	}
	if err := SaveSKI(ks.path, ski); err != nil {
		logger.Errorf("Failed storing private key [%s]: [%s]", alias, err)
		return err
	}
	
	return nil
}

func (ks *fileBasedKeyStore) storePublicKey(alias string, publicKey interface{}) error {
	rawKey, err := utils.PublicKeyToPEM(publicKey, ks.pwd)
	if err != nil {
		logger.Errorf("Failed converting public key to PEM [%s]: [%s]", alias, err)
		return err
	}
	
	err = ioutil.WriteFile(ks.getPathForAlias(alias, "pk"), rawKey, 0700)
	if err != nil {
		logger.Errorf("Failed storing private key [%s]: [%s]", alias, err)
		return err
	}
	
	return nil
}

func (ks *fileBasedKeyStore) storeKey(alias string, key []byte) error {
	//pem, err := utils.AEStoEncryptedPEM(key, ks.pwd)
	
	if len(ks.pwd) == 0 {
		ks.pwd = nil
	}
	
	pem, err := sm4.WriteKeytoMem(key, ks.pwd)
	if err != nil {
		logger.Errorf("Failed converting key to PEM [%s]: [%s]", alias, err)
		return err
	}
	
	err = ioutil.WriteFile(ks.getPathForAlias(alias, "key"), pem, 0700)
	if err != nil {
		logger.Errorf("Failed storing key [%s]: [%s]", alias, err)
		return err
	}
	
	return nil
}

func (ks *fileBasedKeyStore) loadPrivateKey(alias string) (interface{}, error) {
	path := ks.getPathForAlias(alias, "sk")
	logger.Infof("loadPrivateKey : %s", path)
	logger.Debugf("Loading private key [%s] at [%s]...", alias, path)
	
	raw, err := ioutil.ReadFile(path)
	if err != nil {
		logger.Errorf("Failed loading private key [%s]: [%s].", alias, err.Error())
		
		return nil, err
	}
	
	// privateKey, err := utils.PEMtoPrivateKey(raw, ks.pwd)
	privateKey, err := sm2.ReadPrivateKeyFromMem(raw, nil)
	if err != nil {
		logger.Errorf("Failed parsing private key [%s]: [%s].", alias, err.Error())
		
		return nil, err
	}
	
	return privateKey, nil
}

func (ks *fileBasedKeyStore) loadPublicKey(alias string) (interface{}, error) {
	path := ks.getPathForAlias(alias, "pk")
	logger.Debugf("Loading public key [%s] at [%s]...", alias, path)
	
	raw, err := ioutil.ReadFile(path)
	if err != nil {
		logger.Errorf("Failed loading public key [%s]: [%s].", alias, err.Error())
		
		return nil, err
	}
	
	// privateKey, err := utils.PEMtoPublicKey(raw, ks.pwd)
	privateKey, err := sm2.ReadPublicKeyFromMem(raw, nil)
	if err != nil {
		logger.Errorf("Failed parsing private key [%s]: [%s].", alias, err.Error())
		
		return nil, err
	}
	
	return privateKey, nil
}

func (ks *fileBasedKeyStore) loadKey(alias string) ([]byte, error) {
	path := ks.getPathForAlias(alias, "key")
	logger.Infof("loadKey : %s", path)
	logger.Debugf("Loading key [%s] at [%s]...", alias, path)
	
	pem, err := ioutil.ReadFile(path)
	if err != nil {
		logger.Errorf("Failed loading key [%s]: [%s].", alias, err.Error())
		
		return nil, err
	}
	
	//key, err := utils.PEMtoAES(pem, ks.pwd)
	if len(ks.pwd) == 0 {
		ks.pwd = nil
	}
	key, err := sm4.ReadKeyFromMem(pem, ks.pwd)
	if err != nil {
		logger.Errorf("Failed parsing key [%s]: [%s]", alias, err)
		
		return nil, err
	}
	
	return key, nil
}

func (ks *fileBasedKeyStore) createKeyStoreIfNotExists() error {
	// Check keystore directory
	ksPath := ks.path
	missing, err := utils.DirMissingOrEmpty(ksPath)
	
	if missing {
		logger.Debugf("KeyStore path [%s] missing [%t]: [%s]", ksPath, missing, utils.ErrToString(err))
		
		err := ks.createKeyStore()
		if err != nil {
			logger.Errorf("Failed creating KeyStore At [%s]: [%s]", ksPath, err.Error())
			return nil
		}
	}
	
	return nil
}

func (ks *fileBasedKeyStore) createKeyStore() error {
	// Create keystore directory root if it doesn't exist yet
	ksPath := ks.path
	logger.Debugf("Creating KeyStore at [%s]...", ksPath)
	
	os.MkdirAll(ksPath, 0755)
	
	logger.Debugf("KeyStore created at [%s].", ksPath)
	return nil
}

func (ks *fileBasedKeyStore) openKeyStore() error {
	if ks.isOpen {
		return nil
	}
	
	logger.Debugf("KeyStore opened at [%s]...done", ks.path)
	
	return nil
}

func (ks *fileBasedKeyStore) getPathForAlias(alias, suffix string) string {
	return filepath.Join(ks.path, alias+"_"+suffix)
}